Business and workplace
- Microsoft Teams
- Slack
- Lark / Feishu
- DingTalk
- Workplace Chat
- Zoom Team Chat
Messaging application forensics
More than
the visible chat.
Messages may be distributed across the handset, cloud, linked computers, backups, notification records and counterpart devices. We identify the sources that exist, preserve what is available and explain the limits plainly.
Discuss an applicationCore applications
Dedicated application
examination.
Each platform uses different databases, encryption, retention and synchronisation behaviour. Select an application for the relevant forensic considerations.
Other applications
Broader messaging
coverage.
We also assess other consumer, workplace, regional and encrypted communications applications. Inclusion does not imply that every item can be extracted from every device.
Regional and social
- KakaoTalk
- Zalo
- imo
- Snapchat
- Instagram Direct
Private and encrypted
- Threema
- Wickr
- Wire
- Element / Matrix
- Session
- SafeW
Device and carrier
- Google Messages / RCS
- Samsung Messages
- SMS and MMS
- Google Chat
- Skype
- BlackBerry Messenger archives
Application not listed?
Tell us the application name, device model, operating-system version, relevant dates and whether lawful credentials or backups are available. We will assess feasibility before proposing substantive work.
Request a feasibility assessmentAcquisition routes
Applications leave
different records.
Depending on configuration and lawful access, an examination may combine live or backup acquisition, application databases, media and thumbnails, database journals, notifications, linked computers, synchronised account data, service-held records and compatible third-party forensic images.
Local application data
Active databases, configuration, identifiers, attachments, caches, logs and residual database structures may preserve more than the visible interface.
Account and cloud data
Available messaging backups, cloud chats or authorised account collection may extend the record, subject to service design, authentication and retention.
Imported acquisitions
Compatible backups, file-system images, device images and forensic exports can be re-examined when their provenance, integrity and acquisition scope are sufficient.
A qualified scope
Availability is
device-specific.
01Exact application and regional version confirmed.
02Device, software, access and encryption state assessed.
03Cloud, backup, desktop and counterpart sources considered.
04Recovery prospects and evidential limitations stated before conclusions.
Confidential case review
